<br><br><div class="gmail_quote">On Wed, Jan 19, 2011 at 11:30 AM, Bro Tracker <span dir="ltr"><<a href="mailto:bro@tracker.icir.org">bro@tracker.icir.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
#354: Allow analyser to process partial HTTP connections.<br>
------------------------------+-----------------<br>
Reporter: sridhar.basam | Owner:<br>
Type: Feature Request | Status: new<br>
Priority: Normal | Milestone:<br>
Component: Bro | Version:<br>
Resolution: | Keywords:<br>
------------------------------+-----------------<br>
<br>
Old description:<br>
<br>
> By default the HTTP analyser doesn't process packets where bro did not<br>
> see the initial handshake. I got a couple of 1 line patches from Vern to<br>
> fix it. Can we roll this into a future release?<br>
><br>
> Sridhar<br>
<br>
New description:<br>
<br>
By default the HTTP analyser doesn't process packets where bro did not see<br>
the initial handshake. I got a couple of 1 line patches from Vern to fix<br>
it. Can we roll this into a future release?<br>
<br>
Sridhar<br>
<br>
--<br>
<br>
Comment (by seth):<br>
<br>
This is a fairly large change in semantics for how Bro currently functions<br>
and I'm curious what your motivation for this change is. Can you give an<br>
example of the conditions where this is causing a problem for you?<br>
<font color="#888888"><br>
--<br>
Ticket URL: <<a href="http://tracker.icir.org/bro/ticket/354#comment:1" target="_blank">http://tracker.icir.org/bro/ticket/354#comment:1</a>><br>
Bro Tracker <<a href="http://tracker.icir.org/bro" target="_blank">http://tracker.icir.org/bro</a>><br>
Bro Issue Tracker<br>
</font></blockquote></div><br><div><br></div><div>I have applications which use a persistant HTTP connections to talk to upstream services. These connections live for a really long time, thousands/tens of thousands of requests on a single tcp connection. I use bro to analyse http request and replies for these applications. I need the ability to run the analyser for these partial connections in the pcap file.</div>
<div><br></div><div> Sridhar</div>